80th OREGON LEGISLATIVE ASSEMBLY Regular Session. Senate Bill 703

Transcription

1 0th OREGON LEGISLATIVE ASSEMBLY--0 Regular Session Senate Bill 0 Sponsored by Senator PROZANSKI, Representatives GOMBERG, HOLVEY; Senators BEYER, BOQUIST, COURTNEY, DEMBROW, FAGAN, FREDERICK, GOLDEN, KNOPP, LINTHICUM, MANNING JR, MONNES ANDERSON, RILEY, ROBLAN, STEINER HAYWARD, TAYLOR, THATCHER, WAGNER, Representatives ALONSO LEON, EVANS, HERNANDEZ, LEIF, LIVELY, MEEK, NOBLE, NOSSE, PILUSO, POWER, PRUSAK, REARDON, SALINAS, SANCHEZ, SCHOUTEN, SOLLMAN, STARK, WILDE, WILSON, WITT (at the request of Hu-manity.co ) SUMMARY The following summary is not prepared by the sponsors of the measure and is not a part of the body thereof subject to consideration by the Legislative Assembly. It is an editor s brief statement of the essential features of the measure as introduced. Prohibits commercial sale of health information by covered entity, business associate, subcontractor, as defined by Health Insurance Portability and Accountability Act of, or other third party, without authorization of individual whose health information would be included in sale. Makes violation of prohibition unlawful practice. Becomes operative January, A BILL FOR AN ACT Relating to the sale of health information; creating new provisions; and amending ORS.0. Whereas the Health Insurance Portability and Accountability Act of (HIPAA) protects the privacy and security of the protected health information of an individual and affords the individual the right to access, amend and obtain an accounting of disclosures of the individual s protected health information; and Whereas HIPAA balances these protections and individual rights with the need to avoid the creation of unnecessary barriers to the access of quality health care; and Whereas, notwithstanding individuals expectations that protected health information will be used and disclosed as necessary to treat them, to bill for treatment and, to some extent, to operate a covered entity s health care business, protected health information is often used for purposes unrelated to treatment, payment or health care operations of the covered entity; and Whereas companies that provide services on behalf of covered entities that give them and their contractors access to protected health information, routinely de-identify individuals protected health information in order to sell the information in de-identified form to third parties for remuneration; and Whereas after protected health information has been de-identified, it is no longer protected by or subject to HIPAA; however, the de-identification process itself is a use of protected health information that may only be performed under limited circumstances and for limited purposes under HIPAA; and Whereas an individual may authorize a use or disclosure of the individual s protected health information that is not otherwise permitted by HIPAA, such as for the de-identification of protected health information for the purpose of commercial sale; and Whereas the individual who authorizes the de-identification of the individual s protected health information for the purpose of commercial sale should have the right to assert a property interest in the health information such that the individual may receive remuneration in connection with the commercial sale; now, therefore, NOTE: Matter in boldfaced type in an amended section is new; matter [italic and bracketed] is existing law to be omitted. New sections are in boldfaced type. LC

2 SB Be It Enacted by the People of the State of Oregon: SECTION. As used in this section and section of this 0 Act: () Authorization means an authorization that: (a) Meets the requirements for a valid authorization as prescribed by C.F.R..0; and (b) Includes a statement informing the individual that the individual may elect to receive a share of any remuneration received by the covered entity, business associate, subcontractor or other third party, in exchange for authorizing the commercial sale of the individual s protected health information, health information or de-identified data. () Business associate has the meaning given that term in C.F.R ()(a) Commercial sale means the disclosure of health information, including deidentified data, by a covered entity, business associate, subcontractor or other third party, if the covered entity, business associate, subcontractor or other third party directly or indirectly receives remuneration from or on behalf of the recipient of the health information in exchange for the information. (b) Commercial sale does not include the disclosure of health information by a covered entity, business associate, subcontractor or other third party for any of the following purposes: (A) Public health activities as described in C.F.R..(b); (B) Research, as described in C.F.R..(i) and.(e), if the only remuneration received by the covered entity, business associate, subcontractor or other third party is a reasonable cost-based fee to cover the cost to prepare and transmit the de-identified data for such purposes; (C) Judicial and administrative proceedings as described in C.F.R..(e); (D) Treatment, payment or health care operations as described in C.F.R..0(a) and (c); (E) Sale, transfer, merger or consolidation of all or part of the covered entity, business associate, subcontractor or other third party and for related due diligence; (F) Performance of services delineated in a contract or other arrangement, as described in C.F.R..0(e) or.0(e), in which the only remuneration provided is to a covered entity, business associate, subcontractor or other third party for the performance of the services; (G) Activities of a health oversight agency as described in C.F.R..(d); (H) Law enforcement activities as described in C.F.R..(f); (I) To avert a serious threat to health or safety as described in C.F.R..(j); (J) Specialized governmental functions as described in C.F.R..(k); (K) Workers compensation as described in C.F.R..(l); (L) To address fraud, security or technical issues as may be reasonably necessary to protect the covered entity, business associate, subcontractor or other third party or to protect the individual; or (M) When required by law as described in C.F.R..(a). () Covered entity has the meaning given that term in C.F.R () De-identified data means health information that meets the requirements for deidentification of protected health information under C.F.R... () Disclosure means the release, transfer, sharing, dissemination or any other com- []

3 SB munication, whether orally, in writing, electronically or by any other means, of health information to a third party. () Health care operations has the meaning given that term in C.F.R..0. () Health information has the meaning given that term in C.F.R () Health oversight agency has the meaning given that term in C.F.R..0. (0) Individual means the individual who is the subject of protected health information. () Payment has the meaning given that term in C.F.R..0. () Protected health information has the meaning given that term in C.F.R () Required by law has the meaning given that term in C.F.R..0. () Research has the meaning given that term in C.F.R..0. () Subcontractor has the meaning given that term in C.F.R () Third party means a person who is not a covered entity, business associate or subcontractor authorized to do business in this state and who is not the individual. () Treatment has the meaning given that term in C.F.R..0. SECTION. () A covered entity, business associate, subcontractor or other third party doing business in this state may not engage in the commercial sale of protected health information, health information or de-identified data without first obtaining a signed authorization from the individual. () A covered entity, business associate, subcontractor or other third party doing business in this state may not discriminate against or penalize an individual who declines to sign an authorization or who elects to receive remuneration in exchange for signing an authorization. () A covered entity, business associate, subcontractor or other third party shall provide a share of any remuneration received by the covered entity, business associate, subcontractor or other third party to an individual who elects to receive remuneration in exchange for signing an authorization. () A third party that has not obtained a signed authorization from the individual may not engage in the commercial sale of any protected health information, health information or de-identified data purchased or otherwise obtained from a covered entity, business associate or subcontractor without first documenting that a signed authorization has been obtained by the covered entity, business associate or subcontractor in accordance with subsection () of this section. () This section does not apply to a public body, a federal agency or the business associates or subcontractors of a public body or federal agency with respect to health information created, received, transmitted or maintained by the business associate or subcontractor on behalf of the public body or federal agency. () Violation of subsection (), (), () or () of this section is an unlawful practice under ORS.0. SECTION. ORS.0 is amended to read:.0. () A person engages in an unlawful practice if in the course of the person s business, vocation or occupation the person does any of the following: (a) Passes off real estate, goods or services as the real estate, goods or services of another. (b) Causes likelihood of confusion or of misunderstanding as to the source, sponsorship, approval, or certification of real estate, goods or services. (c) Causes likelihood of confusion or of misunderstanding as to affiliation, connection, or asso- []

4 SB ciation with, or certification by, another. (d) Uses deceptive representations or designations of geographic origin in connection with real estate, goods or services. (e) Represents that real estate, goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, quantities or qualities that the real estate, goods or services do not have or that a person has a sponsorship, approval, status, qualification, affiliation, or connection that the person does not have. (f) Represents that real estate or goods are original or new if the real estate or goods are deteriorated, altered, reconditioned, reclaimed, used or secondhand. (g) Represents that real estate, goods or services are of a particular standard, quality, or grade, or that real estate or goods are of a particular style or model, if the real estate, goods or services are of another. (h) Disparages the real estate, goods, services, property or business of a customer or another by false or misleading representations of fact. (i) Advertises real estate, goods or services with intent not to provide the real estate, goods or services as advertised, or with intent not to supply reasonably expectable public demand, unless the advertisement discloses a limitation of quantity. (j) Makes false or misleading representations of fact concerning the reasons for, existence of, or amounts of price reductions. (k) Makes false or misleading representations concerning credit availability or the nature of the transaction or obligation incurred. (L) Makes false or misleading representations relating to commissions or other compensation to be paid in exchange for permitting real estate, goods or services to be used for model or demonstration purposes or in exchange for submitting names of potential customers. (m) Performs service on or dismantles any goods or real estate if the owner or apparent owner of the goods or real estate does not authorize the service or dismantling. (n) Solicits potential customers by telephone or door to door as a seller unless the person provides the information required under ORS.. (o) In a sale, rental or other disposition of real estate, goods or services, gives or offers to give a rebate or discount or otherwise pays or offers to pay value to the customer in consideration of the customer giving to the person the names of prospective purchasers, lessees, or borrowers, or otherwise aiding the person in making a sale, lease, or loan to another person, if earning the rebate, discount or other value is contingent upon an event occurring after the time the customer enters into the transaction. (p) Makes any false or misleading statement about a prize, contest or promotion used to publicize a product, business or service. (q) Promises to deliver real estate, goods or services within a certain period of time with intent not to deliver the real estate, goods or services as promised. (r) Organizes or induces or attempts to induce membership in a pyramid club. (s) Makes false or misleading representations of fact concerning the offering price of, or the person s cost for real estate, goods or services. (t) Concurrent with tender or delivery of any real estate, goods or services fails to disclose any known material defect or material nonconformity. (u) Engages in any other unfair or deceptive conduct in trade or commerce. (v) Violates any of the provisions relating to auction sales, consignment sales, auctioneers, []

5 SB consignees or auction marts under ORS.0, whether in a commercial or noncommercial situation. (w) Manufactures mercury fever thermometers. (x) Sells or supplies mercury fever thermometers unless the thermometer is required by federal law, or is: (A) Prescribed by a person licensed under ORS chapter ; and (B) Supplied with instructions on the careful handling of the thermometer to avoid breakage and on the proper cleanup of mercury should breakage occur. (y) Sells a thermostat that contains mercury unless the thermostat is labeled in a manner to inform the purchaser that mercury is present in the thermostat and that the thermostat may not be disposed of until the mercury is removed, reused, recycled or otherwise managed to ensure that the mercury does not become part of the solid waste stream or wastewater. For purposes of this paragraph, thermostat means a device commonly used to sense and, through electrical communication with heating, cooling or ventilation equipment, control room temperature. (z) Sells or offers for sale a motor vehicle manufactured after January, 00, that contains mercury light switches. (aa) Violates the provisions of ORS 0., 0. or.0 to.0. (bb) Violates ORS A.00 (). (cc) Violates any requirement of ORS A.00 to A.00. (dd) Violates the provisions of ORS.0 to.. (ee) Violates ORS. or.. (ff) Violates ORS.. (gg) Violates the provisions of ORS A.. (hh) Violates ORS A.0. (ii) Violates ORS. or. or any rule adopted pursuant thereto. (jj) Violates ORS.. (kk) Violates ORS.0 or any rule adopted pursuant thereto. (LL) Violates the provisions of ORS.0,.0 and.0 or any rule adopted pursuant thereto. (mm) Violates ORS A.0 or A.. (nn) Violates any provision of ORS A. to A.. (oo) Violates ORS A.0. (pp) Violates ORS.0. (qq) Violates ORS.00. (rr) Violates ORS A.00 () to (). (ss) Violates ORS A.00 () to (). (tt) Violates ORS.. (uu) Violates ORS A.0. (vv) Violates ORS A.. (ww) Violates ORS A.0 or any rule adopted under ORS A.0 or A.0. (xx) Violates ORS 0.0 () or 0. (). (yy) Commits the offense of acting as a vehicle dealer without a certificate under ORS.00. (zz) Violates ORS.00 () or (). (aaa) Violates ORS.0 (), () or (). (bbb) Engages in an unlawful practice under ORS.. []

6 SB (ccc) Violates ORS A.. (ddd) Violates ORS.,.,. or. or a rule adopted under ORS.. (eee) Sells a gift card in violation of ORS A.. (fff) Violates ORS A.0, A.0 or A.0. (ggg) Violates ORS A.0 to A.0. (hhh) Violates a provision of ORS. to.. (iii) Violates a provision of ORS A.0 to A.0. (jjj) Violates ORS A.0 0 or more days after a recall notice, warning or declaration described in ORS A.0 is issued for the children s product, as defined in ORS A., that is the subject of the violation. (kkk) Violates a provision of ORS.,.,.,.,.,. or.0. (LLL) Violates the consumer protection provisions of the Servicemembers Civil Relief Act, 0 U.S.C. App. 0 et seq., as in effect on January, 00. (mmm) Violates a provision of ORS A.0 to A.. (nnn) Violates ORS A.0. (ooo) Violates ORS.. (ppp) Violates ORS A.. (qqq) Violates a provision of ORS A.0. (rrr) Violates ORS A.0. (sss) Violates a provision of ORS.. (ttt) Violates a provision of ORS A.. (uuu) Violates ORS A.. (vvv) Engages in the business of, or acts in the capacity of, an immigration consultant, as defined in ORS.0, in this state and for compensation, unless federal law authorizes the person to do so or unless the person is an active member of the Oregon State Bar. (www) Violates ORS 0.0, 0.0 or 0.0. (xxx) Violates ORS A.0. (yyy) Violates ORS A.0 (). (zzz) Violates a provision of sections to, chapter, Oregon Laws 0. (aaaa) Violates ORS.. (bbbb) Violates section (), (), () or () of this 0 Act. () A representation under subsection () of this section or ORS.0 may be any manifestation of any assertion by words or conduct, including, but not limited to, a failure to disclose a fact. () In order to prevail in an action or suit under ORS. and.0 to., a prosecuting attorney need not prove competition between the parties or actual confusion or misunderstanding. () An action or suit may not be brought under subsection ()(u) of this section unless the Attorney General has first established a rule in accordance with the provisions of ORS chapter declaring the conduct to be unfair or deceptive in trade or commerce. () Notwithstanding any other provision of ORS. and.0 to., if an action or suit is brought under subsection ()(xx) of this section by a person other than a prosecuting attorney, relief is limited to an injunction and the prevailing party may be awarded reasonable attorney fees. SECTION. ORS.0, as amended by section 0, chapter, Oregon Laws 0, section, chapter, Oregon Laws 0, section, chapter, Oregon Laws 0, section, chapter []

7 SB , Oregon Laws 0, and section, chapter, Oregon Laws 0, is amended to read:.0. () A person engages in an unlawful practice if in the course of the person s business, vocation or occupation the person does any of the following: (a) Passes off real estate, goods or services as the real estate, goods or services of another. (b) Causes likelihood of confusion or of misunderstanding as to the source, sponsorship, approval, or certification of real estate, goods or services. (c) Causes likelihood of confusion or of misunderstanding as to affiliation, connection, or association with, or certification by, another. (d) Uses deceptive representations or designations of geographic origin in connection with real estate, goods or services. (e) Represents that real estate, goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, quantities or qualities that the real estate, goods or services do not have or that a person has a sponsorship, approval, status, qualification, affiliation, or connection that the person does not have. (f) Represents that real estate or goods are original or new if the real estate or goods are deteriorated, altered, reconditioned, reclaimed, used or secondhand. (g) Represents that real estate, goods or services are of a particular standard, quality, or grade, or that real estate or goods are of a particular style or model, if the real estate, goods or services are of another. (h) Disparages the real estate, goods, services, property or business of a customer or another by false or misleading representations of fact. (i) Advertises real estate, goods or services with intent not to provide the real estate, goods or services as advertised, or with intent not to supply reasonably expectable public demand, unless the advertisement discloses a limitation of quantity. (j) Makes false or misleading representations of fact concerning the reasons for, existence of, or amounts of price reductions. (k) Makes false or misleading representations concerning credit availability or the nature of the transaction or obligation incurred. (L) Makes false or misleading representations relating to commissions or other compensation to be paid in exchange for permitting real estate, goods or services to be used for model or demonstration purposes or in exchange for submitting names of potential customers. (m) Performs service on or dismantles any goods or real estate if the owner or apparent owner of the goods or real estate does not authorize the service or dismantling. (n) Solicits potential customers by telephone or door to door as a seller unless the person provides the information required under ORS.. (o) In a sale, rental or other disposition of real estate, goods or services, gives or offers to give a rebate or discount or otherwise pays or offers to pay value to the customer in consideration of the customer giving to the person the names of prospective purchasers, lessees, or borrowers, or otherwise aiding the person in making a sale, lease, or loan to another person, if earning the rebate, discount or other value is contingent upon an event occurring after the time the customer enters into the transaction. (p) Makes any false or misleading statement about a prize, contest or promotion used to publicize a product, business or service. (q) Promises to deliver real estate, goods or services within a certain period of time with intent not to deliver the real estate, goods or services as promised. []

8 SB (r) Organizes or induces or attempts to induce membership in a pyramid club. (s) Makes false or misleading representations of fact concerning the offering price of, or the person s cost for real estate, goods or services. (t) Concurrent with tender or delivery of any real estate, goods or services fails to disclose any known material defect or material nonconformity. (u) Engages in any other unfair or deceptive conduct in trade or commerce. (v) Violates any of the provisions relating to auction sales, consignment sales, auctioneers, consignees or auction marts under ORS.0, whether in a commercial or noncommercial situation. (w) Manufactures mercury fever thermometers. (x) Sells or supplies mercury fever thermometers unless the thermometer is required by federal law, or is: (A) Prescribed by a person licensed under ORS chapter ; and (B) Supplied with instructions on the careful handling of the thermometer to avoid breakage and on the proper cleanup of mercury should breakage occur. (y) Sells a thermostat that contains mercury unless the thermostat is labeled in a manner to inform the purchaser that mercury is present in the thermostat and that the thermostat may not be disposed of until the mercury is removed, reused, recycled or otherwise managed to ensure that the mercury does not become part of the solid waste stream or wastewater. For purposes of this paragraph, thermostat means a device commonly used to sense and, through electrical communication with heating, cooling or ventilation equipment, control room temperature. (z) Sells or offers for sale a motor vehicle manufactured after January, 00, that contains mercury light switches. (aa) Violates the provisions of ORS 0., 0. or.0 to.0. (bb) Violates ORS A.00 (). (cc) Violates any requirement of ORS A.00 to A.00. (dd) Violates the provisions of ORS.0 to.. (ee) Violates ORS. or.. (ff) Violates ORS.. (gg) Violates the provisions of ORS A.. (hh) Violates ORS A.0. (ii) Violates ORS. or. or any rule adopted pursuant thereto. (jj) Violates ORS.. (kk) Violates ORS.0 or any rule adopted pursuant thereto. (LL) Violates the provisions of ORS.0,.0 and.0 or any rule adopted pursuant thereto. (mm) Violates ORS A.0 or A.. (nn) Violates any provision of ORS A. to A.. (oo) Violates ORS A.0. (pp) Violates ORS.0. (qq) Violates ORS.00. (rr) Violates ORS A.00 () to (). (ss) Violates ORS A.00 () to (). (tt) Violates ORS.. (uu) Violates ORS A.0. []

9 SB (vv) Violates ORS A.. (ww) Violates ORS A.0 or any rule adopted under ORS A.0 or A.0. (xx) Violates ORS 0.0 () or 0. (). (yy) Commits the offense of acting as a vehicle dealer without a certificate under ORS.00. (zz) Violates ORS.00 () or (). (aaa) Violates ORS.0 (), () or (). (bbb) Engages in an unlawful practice under ORS.. (ccc) Violates ORS A.. (ddd) Violates ORS.,.,. or. or a rule adopted under ORS.. (eee) Sells a gift card in violation of ORS A.. (fff) Violates ORS A.0, A.0 or A.0. (ggg) Violates ORS A.0 to A.0. (hhh) Violates a provision of ORS. to.. (iii) Violates a provision of ORS A.0 to A.0. (jjj) Violates ORS A.0 0 or more days after a recall notice, warning or declaration described in ORS A.0 is issued for the children s product, as defined in ORS A., that is the subject of the violation. (kkk) Violates a provision of ORS.,.,.,.,.,. or.0. (LLL) Violates the consumer protection provisions of the Servicemembers Civil Relief Act, 0 U.S.C. App. 0 et seq., as in effect on January, 00. (mmm) Violates a provision of ORS A.0 to A.. (nnn) Violates ORS A.0. (ooo) Violates ORS.. (ppp) Violates ORS A.. (qqq) Violates a provision of ORS A.0. (rrr) Violates ORS A.0. (sss) Violates a provision of ORS.. (ttt) Violates a provision of ORS A.. (uuu) Violates ORS A.. (vvv) Engages in the business of, or acts in the capacity of, an immigration consultant, as defined in ORS.0, in this state and for compensation, unless federal law authorizes the person to do so or unless the person is an active member of the Oregon State Bar. (www) Violates ORS 0.0, 0.0 or 0.0. (xxx) Violates ORS A.0. (yyy) Violates ORS A.0 (). (zzz) Violates ORS.. (aaaa) Violates section (), (), () or () of this 0 Act. () A representation under subsection () of this section or ORS.0 may be any manifestation of any assertion by words or conduct, including, but not limited to, a failure to disclose a fact. () In order to prevail in an action or suit under ORS. and.0 to., a prosecuting attorney need not prove competition between the parties or actual confusion or misunderstanding. () An action or suit may not be brought under subsection ()(u) of this section unless the Attorney General has first established a rule in accordance with the provisions of ORS chapter declaring the conduct to be unfair or deceptive in trade or commerce. []

10 SB 0 0 () Notwithstanding any other provision of ORS. and.0 to., if an action or suit is brought under subsection ()(xx) of this section by a person other than a prosecuting attorney, relief is limited to an injunction and the prevailing party may be awarded reasonable attorney fees. SECTION. Sections and of this 0 Act and the amendments to ORS.0 by sections and of this 0 Act become operative on January, 0. SECTION. The Attorney General may take any action before January, 0, that is necessary to enable the Attorney General to enforce the provisions of sections and of this 0 Act and the amendments to ORS.0 by sections and of this 0 Act on and after January, 0. [0]